Critical WhatsApp API Flaw Exposed 3.5 Billion Phone Numbers

On the face of it, the world’s most-popular messaging app appears secure: end-to-end encryption, two-factor log-in support, and a legacy of robust deployment. But beneath the surface of user messages and encrypted chats, an insidious weakness has quietly persisted — and it has now been exposed in dramatic fashion. Researchers from University of Vienna and SBA Research have revealed that through the -discovery API of WhatsApp, it was possible to enumerate 3.5 billion active accounts worldwide, harvesting phone numbers, profile pictures, “ ” texts, timestamp data and more. The session saw query rates of over 100 million numbers per hour without interruption, revealing an alarming lack of rate-limiting or throttling by WhatsApp’s backend.

In effect, what the researchers call “the largest data leak in history, if it had been malicious” now stands as a wake-up call for messaging services, regulators and users alike.

At the heart of the issue is the “ discovery” mechanism used by WhatsApp. This feature, designed to let users find which of their phone contacts are on WhatsApp, allows the app to query the server: “Does this phone number correspond to an active WhatsApp account?”

The researchers at Vienna/SBA built a tool to generate 63 billion plausible mobile phone numbers across 245 countries, and systematically fed them into the API endpoint. They executed the enumeration from a single university server, making five authenticated sessions, and speed reached ~7,000 numbers per second per session. Crucially, WhatsApp did not block their IPs, did not throttle the rate, and did not send notifications of suspicious activity. The result: confirmation of 3.5 billion active WhatsApp accounts, and for many of those, additional publicly-exposed metadata: profile pictures in ~57 % of cases, “ ” texts in ~29 %.

In short, a well-funded academic team used standard APIs, no zero-day exploit, and within weeks mapped nearly the full global WhatsApp user base.

It might be tempting to dismiss phone numbers and profile photos as trivial. But the implications are far more serious:

Identity Linking & Profiling A phone number alone can often be linked to a given individual; when joined with profile picture and public “ ” text (which sometimes includes social-media handles, nicknames, location references), one can build user profiles at scale.

Persistence of Value Once a phone number is tied to a user and exposed, the risk doesn’t evaporate quickly. The researchers noted that 58 % of the phone numbers leaked in the 2021 Meta Platforms/ phone-number leak were still active on WhatsApp in 2025.

Metadata is Not Harmless Although WhatsApp’s messaging content remains end-to-end encrypted, metadata (who you are, when you use the app, what device you run, what profile image you set) can reveal a lot you — and can be abused for phishing, SIM-swap attacks, targeted spam, or state-level surveillance. The Vienna team emphasizes this: “Our work shows that privacy risks can also arise when such metadata is collected and analysed on a large scale.”

Regional & Political Risk The enumeration found millions of active WhatsApp accounts in countries where the app is officially banned — including China, Iran, Myanmar, North Korea. That raises further concerns state monitoring, targeting of dissidents or activists.

Several factors combined to make this possible:

Phone numbers as identifiers. The researchers argue that using telephone numbers as unique account identifiers is inherently weak when you have billions of users. Phone numbers are structured, predictable, and searchable. “Phone numbers were not designed to be used as secret identifiers for accounts, but that’s how they’re used in practice.”

Lack of rate-limiting. For years, WhatsApp’s API allowed the -discovery feature to be queried at enormous scale without blocking. Even though this technique had been pointed out in 2017, the protections were not robust enough.

Balancing usability with security. For WhatsApp, the discovery feature is central to its ease of use. Restricting it too heavily could degrade the user experience. But the result is a trade-off: convenience versus exposure.

Public visibility. WhatsApp (and its parent Meta) emphasize that much of the exposed data (profile picture, “ ” text) is “publicly available” if you have the phone number and that there is no evidence of malicious actors abusing this vector

According to the official statements, upon being notified in April 2025, WhatsApp implemented additional rate-limiting protections by October 2025.

That said, a few questions remain:

How many bad actors were already exploiting the flaw before the patch? The researchers deleted their dataset and found no evidence of malicious actors during their study — but that does not preclude less-visible misuse prior to disclosure. Are the protections sufficient? Rate-limiting helps, but the fundamental architecture (phone number as identifier + permitted discovery queries) remains the same. The researchers suggest WhatsApp is already rolling out username-based alternatives. What regulatory implications? In jurisdictions such as the EU under GDPR, the existence of an enumeration flaw that allowed harvesting of personal identifiers (phone numbers tied to accounts) may trigger investigation, especially given WhatsApp’s global reach and the fact that millions of accounts were exposed in banned countries where users may be at greater risk.

Be cautious what you publish as your profile picture and “ ” text — consider limiting visibility to contacts only. Recognize that your phone number is more public than you might assume; reuse of the same number over many services increases exposure risk. Consider that even “public” metadata can be used in attacks — phishing, social engineering, SIM-swap are real and increasing.

For developers & platform-builders :

Rate-limiting and API request caps are essential — even “innocent” discovery features can be abused at scale. Use identifiers that are less predictable and less enumeration-friendly. Phone numbers may be too structured for services targeting billions of users. Treat metadata as valuable and sensitive data — just because message content is encrypted doesn’t mean everything else is harmless. Collaboration with academic researchers and transparent disclosures matter; independent investigation helps unearth risks before they’re exploited.

For regulators & policymakers :

Enumeration attacks aren’t “traditional breaches” of content, but they can nonetheless expose vast amounts of personal identifiers — the regulatory frameworks must account for metadata exposure. Cross-border services like WhatsApp must anticipate risk in countries with bans or heavy surveillance — enumeration there poses human-rights risks. Incident disclosure thresholds might need revisiting: even if no “data breach” in the traditional sense (no message content compromised), mass enumeration still requires notification and possibly regulatory action.

The WhatsApp enumeration episode is a reminder that scale + convenience = risk. For a service used by billions, even a “small” design decision — allow unlimited queries of phone-number lookups — can yield a global database of user identities. While the enumeration did not expose message contents, the fact that 3.5 billion accounts could be swept up with relative ease is sobering.

Ultimately, the fix (rate-limiting) is a necessary step, but the underlying architecture remains fragile. Messaging apps — especially those built around ubiquitous identifiers like phone numbers — must ask: how do we balance discovery, convenience and privacy at a global-scale service?